topic Why need index when create dataset in Datamodel in Splunk 7.3 in Splunk Enterprise

Why need index when create dataset in Datamodel in Splunk 7.3

longnh26 — Wed, 02 Oct 2019 02:39:49 GMT

Now i using Splunk 7.3 and creating datamodel with search sourcetype but it's false ??
I try with splunk 7.2 and lower then Ok.

Please tell me why? and how to fix it?

Re: Why need index when create dataset in Datamodel in Splunk 7.3

ivanreis — Wed, 02 Oct 2019 07:37:19 GMT

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http

Re: Why need index when create dataset in Datamodel in Splunk 7.3

gfreitas — Wed, 02 Oct 2019 11:56:00 GMT

Maybe if you add index=* it works?

Re: Why need index when create dataset in Datamodel in Splunk 7.3

broberg — Wed, 02 Oct 2019 11:56:04 GMT

You should always have a index specified in the datamodel even if its index=* so if you don't have any index anywere, that error seems to be correct.

Re: Why need index when create dataset in Datamodel in Splunk 7.3

longnh26 — Thu, 03 Oct 2019 07:49:57 GMT

because this index have many other data, then i think if use only sourcetype to increase performance.

Re: Why need index when create dataset in Datamodel in Splunk 7.3

longnh26 — Thu, 03 Oct 2019 07:50:27 GMT

Yes, it's work. But this index have many other data, then i think if use only sourcetype to increase performance.